Commit 70c0ae91 authored by Michael Niedermayer's avatar Michael Niedermayer

matroskadec: avoid integer overflow

Found-by: wm4
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 2265bb93
...@@ -1638,7 +1638,7 @@ static int matroska_read_header(AVFormatContext *s) ...@@ -1638,7 +1638,7 @@ static int matroska_read_header(AVFormatContext *s)
&& (track->codec_priv.data != NULL)) { && (track->codec_priv.data != NULL)) {
fourcc = AV_RL32(track->codec_priv.data); fourcc = AV_RL32(track->codec_priv.data);
codec_id = ff_codec_get_id(ff_codec_movvideo_tags, fourcc); codec_id = ff_codec_get_id(ff_codec_movvideo_tags, fourcc);
} else if (codec_id == AV_CODEC_ID_ALAC && track->codec_priv.size && track->codec_priv.size < INT_MAX-12) { } else if (codec_id == AV_CODEC_ID_ALAC && track->codec_priv.size && track->codec_priv.size < INT_MAX - 12 - FF_INPUT_BUFFER_PADDING_SIZE) {
/* Only ALAC's magic cookie is stored in Matroska's track headers. /* Only ALAC's magic cookie is stored in Matroska's track headers.
Create the "atom size", "tag", and "tag version" fields the Create the "atom size", "tag", and "tag version" fields the
decoder expects manually. */ decoder expects manually. */
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment